Add signatures-jitter option

Add an option to speficy signatures jitter.

(cherry picked from commit 2a4daaedca0f5e24d362acf1e12c1710489e9a86)

diff --git a/bin/named/config.c b/bin/named/config.c
index f95e4336ed0d109f5c384e8d606f7c699163e3cc..6bf0b3ca81cc61c5f91b56c004115c3113eac5d8 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -309,6 +309,7 @@ dnssec-policy \"default\" {\n\
        publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
        retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
        purge-keys " DNS_KASP_PURGE_KEYS "; \n\
+       signatures-jitter " DNS_KASP_SIG_JITTER "; \n\
        signatures-refresh " DNS_KASP_SIG_REFRESH "; \n\
        signatures-validity " DNS_KASP_SIG_VALIDITY "; \n\
        signatures-validity-dnskey " DNS_KASP_SIG_VALIDITY_DNSKEY "; \n\

diff --git a/bin/tests/system/checkconf/good-kasp.conf b/bin/tests/system/checkconf/good-kasp.conf
index 17309e5ea6e9353bd0d3df423ad0cccdb3a71ecc..c7dd9efbd82a5ea147b07111ce3f4d036392c52b 100644 (file)
--- a/bin/tests/system/checkconf/good-kasp.conf
+++ b/bin/tests/system/checkconf/good-kasp.conf
@@ -29,6 +29,7 @@ dnssec-policy "test" {
        parent-propagation-delay PT1H;
        publish-safety PT3600S;
        retire-safety PT3600S;
+       signatures-jitter PT12H;
        signatures-refresh P3D;
        signatures-validity P2W;
        signatures-validity-dnskey P14D;

diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
index f8d04089f0bfd6d26b29077b183703a470e174f1..7e0f87901c13c43bbb75d123e59b6f9df2eed67c 100644 (file)
--- a/bin/tests/system/checkconf/good.conf
+++ b/bin/tests/system/checkconf/good.conf
@@ -30,6 +30,7 @@ dnssec-policy "test" {
        publish-safety PT3600S;
        purge-keys P90D;
        retire-safety PT3600S;
+       signatures-jitter PT12H;
        signatures-refresh P3D;
        signatures-validity P2W;
        signatures-validity-dnskey P14D;

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 3dab21be4213b3e5c7ee414db9c5a423f9cad55b..214f64edfeba8c3eef8536dd06538ec1f9ae1dfb 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -6509,6 +6509,16 @@ The following options can be specified in a :any:`dnssec-policy` statement:
     unforeseen events.  This increases the time a key remains published
     after it is no longer active.  The default is ``PT1H`` (1 hour).
 
+.. namedconf:statement:: signatures-jitter
+   :tags: dnssec
+   :short: Specifies a range for signatures expirations.
+
+    To prevent all signatures from expiring at the same moment, BIND 9 may
+    vary the validity interval of individual signatures. The validity of a
+    newly generated signatures is in range between :any:`signatures-validity`
+    (maximum) and :any:`signatures-validity` minus :any:`signatures-jitter`
+    (minimum). The default jitter is 12 hours.
+
 .. namedconf:statement:: signatures-refresh
    :tags: dnssec
    :short: Specifies how frequently an RRSIG record is refreshed.

diff --git a/doc/misc/dnssec-policy.default.conf b/doc/misc/dnssec-policy.default.conf
index 00b8a14656db66b977e2d51ef191f757cda3e124..afe570ad70b7559a4da4d75f812b59e98d7e4f70 100644 (file)
--- a/doc/misc/dnssec-policy.default.conf
+++ b/doc/misc/dnssec-policy.default.conf
@@ -24,6 +24,7 @@ dnssec-policy "default" {
        purge-keys P90D;
 
        // Signature timings
+       signatures-jitter 12h;
        signatures-refresh 5d;
        signatures-validity 14d;
        signatures-validity-dnskey 14d;

diff --git a/doc/misc/options b/doc/misc/options
index da2847708fcd966b9d088bd42e71a98cb92bac47..56cbf323b6552d8542facce821ca8819b15d26b8 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -21,6 +21,7 @@ dnssec-policy <string> {
        publish-safety <duration>;
        purge-keys <duration>;
        retire-safety <duration>;
+       signatures-jitter <duration>;
        signatures-refresh <duration>;
        signatures-validity <duration>;
        signatures-validity-dnskey <duration>;

diff --git a/lib/dns/include/dns/kasp.h b/lib/dns/include/dns/kasp.h
index 4f560a037f59ab4afb2fd7e7b52e2c66d7bd39d8..3dfd922720e2c28f7c043c894d901ae0622f0cc9 100644 (file)
--- a/lib/dns/include/dns/kasp.h
+++ b/lib/dns/include/dns/kasp.h
@@ -75,6 +75,7 @@ struct dns_kasp {
        ISC_LINK(struct dns_kasp) link;
 
        /* Configuration: signatures */
+       uint32_t signatures_jitter;
        uint32_t signatures_refresh;
        uint32_t signatures_validity;
        uint32_t signatures_validity_dnskey;
@@ -105,6 +106,7 @@ struct dns_kasp {
 #define DNS_KASP_VALID(kasp) ISC_MAGIC_VALID(kasp, DNS_KASP_MAGIC)
 
 /* Defaults */
+#define DNS_KASP_SIG_JITTER         "PT12H"
 #define DNS_KASP_SIG_REFRESH        "P5D"
 #define DNS_KASP_SIG_VALIDITY       "P14D"
 #define DNS_KASP_SIG_VALIDITY_DNSKEY "P14D"
@@ -233,6 +235,30 @@ dns_kasp_signdelay(dns_kasp_t *kasp);
  *\li   signature refresh interval.
  */
 
+uint32_t
+dns_kasp_sigjitter(dns_kasp_t *kasp);
+/*%<
+ * Get signature jitter value.
+ *
+ * Requires:
+ *
+ *\li   'kasp' is a valid, frozen kasp.
+ *
+ * Returns:
+ *
+ *\li   signature jitter value.
+ */
+
+void
+dns_kasp_setsigjitter(dns_kasp_t *kasp, uint32_t value);
+/*%<
+ * Set signature jitter value.
+ *
+ * Requires:
+ *
+ *\li   'kasp' is a valid, thawed kasp.
+ */
+
 uint32_t
 dns_kasp_sigrefresh(dns_kasp_t *kasp);
 /*%<

diff --git a/lib/dns/kasp.c b/lib/dns/kasp.c
index d53abfb64c1f3d896bfdc9e083aae20fab7cd1ca..f90f76065c267854a7ed9af3293f606908e5690a 100644 (file)
--- a/lib/dns/kasp.c
+++ b/lib/dns/kasp.c
@@ -127,6 +127,22 @@ dns_kasp_signdelay(dns_kasp_t *kasp) {
        return (kasp->signatures_validity - kasp->signatures_refresh);
 }
 
+uint32_t
+dns_kasp_sigjitter(dns_kasp_t *kasp) {
+       REQUIRE(DNS_KASP_VALID(kasp));
+       REQUIRE(kasp->frozen);
+
+       return (kasp->signatures_jitter);
+}
+
+void
+dns_kasp_setsigjitter(dns_kasp_t *kasp, uint32_t value) {
+       REQUIRE(DNS_KASP_VALID(kasp));
+       REQUIRE(!kasp->frozen);
+
+       kasp->signatures_jitter = value;
+}
+
 uint32_t
 dns_kasp_sigrefresh(dns_kasp_t *kasp) {
        REQUIRE(DNS_KASP_VALID(kasp));

diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c
index ba36b0d8ee9aab2a02185183e41aee2601283aff..db0a382324b73dd0299db41a87cb23c8d2e5e485 100644 (file)
--- a/lib/isccfg/kaspconf.c
+++ b/lib/isccfg/kaspconf.c
@@ -312,7 +312,7 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, dns_kasp_t *default_kasp,
        const char *kaspname = NULL;
        dns_kasp_t *kasp = NULL;
        size_t i = 0;
-       uint32_t sigrefresh = 0, sigvalidity = 0;
+       uint32_t sigjitter = 0, sigrefresh = 0, sigvalidity = 0;
        uint32_t dnskeyttl = 0, dsttl = 0, maxttl = 0;
        uint32_t publishsafety = 0, retiresafety = 0;
        uint32_t zonepropdelay = 0, parentpropdelay = 0;
@@ -360,6 +360,10 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, dns_kasp_t *default_kasp,
        maps[i] = NULL;
 
        /* Configuration: Signatures */
+       sigjitter = get_duration(maps, "signatures-jitter",
+                                DNS_KASP_SIG_JITTER);
+       dns_kasp_setsigjitter(kasp, sigjitter);
+
        sigrefresh = get_duration(maps, "signatures-refresh",
                                  DNS_KASP_SIG_REFRESH);
        dns_kasp_setsigrefresh(kasp, sigrefresh);

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index d5b28baad2737a380d2fe88bee4f09f0468f24f2..7bfd8f9bde82d61fca64509df36b6e16d4003cec 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2211,6 +2211,7 @@ static cfg_clausedef_t dnssecpolicy_clauses[] = {
        { "publish-safety", &cfg_type_duration, 0 },
        { "purge-keys", &cfg_type_duration, 0 },
        { "retire-safety", &cfg_type_duration, 0 },
+       { "signatures-jitter", &cfg_type_duration, 0 },
        { "signatures-refresh", &cfg_type_duration, 0 },
        { "signatures-validity", &cfg_type_duration, 0 },
        { "signatures-validity-dnskey", &cfg_type_duration, 0 },